Surface RT UART-A access

To properly debug Linux a serial console is needed. Tegra30 has 5 hardware UART ports. They are called UART-A/B/C/D/E

UART-A is on the ULPI data pins on the SoC (


UART-A TX can be found on J14. It transmits data at 1.8V UART-A RX can be found on J14. It receives data at 1.8V

Below you can see where you can find the UARTA TX, RX pad.

How to use UART

GND from Surface RT must be connected to GND of your UART adapter. If you use fusee gelee your devices are connected via USB-GND. If not you must find suitable GND on sRT.

To use UART you need i.e. a usb-uart adapter, a raspberry pi, arduino, etc... A "silicon labs cp210x usb to uart bridge" was used in testing. This is a 3V3 chip which is 5V tolerant. Receiving a 1.8V signal works fine. But sending 3.3V to a 1.8V input is dangerous.

Be careful when you remove the soldermask (green layer covering the copper). You dont want to cut the trace or short it to any trace below! These pads are very tiny, soldering them is hard without skill and good equipment. It's recommened to use small solid core wire. if you use stranded wire (like i did) only use 2-3 strands. Cut off the rest. Secure your wires with good tape.

How we found UART A TX

A Fusée Gelée payload which initializes UART-A with Baud: 115200, Bits: 8, Stopbits: 1, Parity:None was used to find it. After initialisation its spams data to the transmit buffer.

We took an oscilloscope and checked that there isn't a pin which provides more than 5V (max of uart adapter).

Spam UART payload output

After this we probed every pin with a usb uart adapter and minicom. After a few seconds we found the corresponding TX-pad.

  • Top left: dmesg -Tw show that sRT is booted in APX mode. Also shows if it gets disconnected.

  • Bottom left: Fusee Gelee launcher with payload and ProductID (see dmesg)

  • Top right: Minicom output

  • Bottom right: Fusee gelee payload source code

How we found UART A RX

At this time we got uboot booting. We got output from uboot over UART-A-TX so we only had to bring an TX signal from pc to the RX pad on surfaceRT.

One educated guess later we found RX next to TX.

Uboot told us that 1 isn't a valid command. after this we tried help and and got a solid answer